Executive Summary
Informations | |||
---|---|---|---|
Name | CVE-2025-20185 | First vendor Publication | 2025-02-05 |
Vendor | Cve | Last vendor Modification | 2025-02-05 |
Security-Database Scoring CVSS v3
Cvss vector : CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N | |||
---|---|---|---|
Overall CVSS Score | 3.4 | ||
Base Score | 3.4 | Environmental Score | 3.4 |
impact SubScore | 2.5 | Temporal Score | 3.4 |
Exploitabality Sub Score | 0.8 | ||
Attack Vector | Local | Attack Complexity | Low |
Privileges Required | High | User Interaction | None |
Scope | Unchanged | Confidentiality Impact | Low |
Integrity Impact | Low | Availability Impact | None |
Calculate full CVSS 3.0 Vectors scores |
Security-Database Scoring CVSS v2
Cvss vector : | |||
---|---|---|---|
Cvss Base Score | N/A | Attack Range | N/A |
Cvss Impact Score | N/A | Attack Complexity | N/A |
Cvss Expoit Score | N/A | Authentication | N/A |
Calculate full CVSS 2.0 Vectors scores |
Detail
A vulnerability in the implementation of the remote access functionality of Cisco AsyncOS Software for Cisco Secure Email and Web Manager, Cisco Secure Email Gateway, and Cisco Secure Web Appliance could allow an authenticated, local attacker to elevate privileges to root. The attacker must authenticate with valid administrator credentials. This vulnerability is due to an architectural flaw in the password generation algorithm for the remote access functionality. An attacker could exploit this vulnerability by generating a temporary password for the service account. A successful exploit could allow the attacker to execute arbitrary commands as root and access the underlying operating system. Note: The Security Impact Rating (SIR) for this vulnerability is Medium due to the unrestricted scope of information that is accessible to an attacker. |
Original Source
Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-20185 |
CWE : Common Weakness Enumeration
% | Id | Name |
---|---|---|
100 % | CWE-250 | Execution with Unnecessary Privileges (CWE/SANS Top 25) |
Sources (Detail)
Source | Url |
---|
Alert History
Date | Informations |
---|---|
2025-02-05 21:20:29 |
|